CVE-2026-84817: WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilder Pluginto a version that resolves this vulnerability.Fixed in 3.6.5.2
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin-level privileges. Exploitation still requires user interaction, as indicated by the UI:R metric.
What is the potential impact if exploitation succeeds?
Successful XSS can affect confidentiality, integrity, and availability at low impact levels. The scope change indicates the impact may extend beyond the vulnerable plugin's own security authority.
Which installations should be considered affected?
WordPress sites using JetFormBuilder version 3.6.5.1 or earlier should be considered affected based on the available version range. The provided data does not identify any configuration prerequisite or workaround.